0

I'm implementing a program that involves saving and reading certificates in the certificate store.

The certificate opening and reading is done through the following 2 APIs:

  CertOpenStore()
  CertFindCertificateInStore()

For example, certificate(A) is stored in the certificate store by the program and I want the user to be unable to interact with the store where the certificate is stored (manually adding, deleting a certificate ...). The deletion or addition of a certificate is implement only by the program. So how do I do this?

Thanks in advance.

sliva
  • 11
  • 4

1 Answers1

1

Basically, you cannot fully get this to work, as it is similar to the DRM problem. A user can always reverse engineer your application and create his own runtime.

You can try and perform a MAC over the store and keep the key in your application. However, if the user finds the key then your store can be changed and a new authentication tag can be created.

In the end you need either a trusted execution environment (TEE) or some kind of access elevation for your application (i.e. running under a specific user that can change files, while the ordinary user can only read the file).

Maarten Bodewes
  • 90,524
  • 13
  • 150
  • 263